Sign in, set up MFA and understand step-up
How to sign in, enrol an authenticator app or passkey, and confirm sensitive actions with a fresh second factor.
tocOn this page
FlowSentry protects regulated decisions, so signing in takes two factors: your password and something only you hold — an authenticator app on your phone or a passkey on your device. Some actions also ask you to confirm it's you again, just before you act. This article walks you through all three.
Sign in
- Open your institution's FlowSentry address. The sign-in page says "Welcome back. Use your organisation credentials."
- Enter your Work email and Password, then select Sign in.
- On the next screen ("One more step. Confirm it's you."), enter the six-digit Verification code from your authenticator app and select Verify. If you have a passkey, your browser offers it instead.
- You land on the Dashboard (
/), which shows today's activity and anything waiting for you.
Every sign-in is recorded in the audit trail.
Note: If the page says Sign-in failed, check your email and password and try again. Repeated failed attempts lock the account for a while, and sign-in attempts are rate-limited. If you are locked out, ask your administrator.
If you signed in with the wrong account, choose Sign in with a different account on the code screen.
Set up your authenticator app
Multi-factor authentication (MFA) is mandatory for the MLRO, Deputy MLRO and Administrator roles; your institution may require it for others. If your role requires it, FlowSentry takes you straight to the enrolment page with the message "Your role requires MFA". Anyone can enrol at any time from the user menu, and you need a second factor before you can carry out any step-up action.
- Open your name in the top-right corner and choose Security & MFA (
/account/mfa). - Under Set up your authenticator app, open an authenticator app on your phone (Microsoft Authenticator, Google Authenticator or any app that supports six-digit time-based codes).
- Scan the code shown on screen. If you cannot scan it, select Or enter the key and type the key into the app instead.
- Enter the six-digit code the app shows now and select Verify.
- You see "Your authenticator app is set up". From now on the app's code is your second factor at sign-in and for step-up.
Tip: Name the entry clearly in your authenticator app (for example "FlowSentry – work") so you pick the right code under time pressure.
Add a passkey (optional, recommended)
A passkey lets you confirm it's you with Touch ID, Windows Hello, your phone or a hardware security key, without typing a code.
- Open the user menu and choose Passkeys (
/account/passkey), or select Add a passkey too after enrolling your app. - Enter a Device label you will recognise later, such as "Work laptop" or "YubiKey".
- Select Add a passkey. Your browser asks you to confirm with the device (fingerprint, face, PIN or key touch).
- The passkey appears under Your passkeys. It can be used at sign-in and for step-up.
You can register several passkeys, for example one on your laptop and one on a security key.
What step-up is and when you will see it
Step-up asks for a fresh second factor immediately before a sensitive action. It proves the person approving is the person signed in, even if a session was left open. A step-up stays valid for five minutes.
You will be asked to step up before, for example:
- filing an STR or deciding a suspicion as MLRO;
- confirming a true screening match, approving a proposed clear or a PEP decision;
- approving a good-guy exclusion or activating a watchlist version;
- activating a monitoring rule or switching a built-in scenario off;
- approving a KYC change, a risk override, a risk model version or high-risk onboarding;
- approving institution settings, turning a kill switch, or approving a data source's go-live or rotating its key.
How to step up
- When an action needs it, the page shows "This action needs a fresh second factor." with Verify now (step-up) — or takes you to the step-up page ("One more check. A sensitive action.").
- Enter the current Authentication code from your app (or use your passkey) and select Confirm.
- FlowSentry returns you to the same item. Complete the action within five minutes.
If you see "That code didn't match", wait for the next code — codes change every 30 seconds — and try again. If codes keep failing, check that your phone's clock is set automatically.
Lost your phone or changed device?
Ask your administrator to reset your MFA enrolment, then enrol again at Security & MFA. If you have a passkey on another device, you can still sign in with it in the meantime.
Warning: Never share an authenticator code or approve a sign-in you did not start. FlowSentry staff will never ask you for a code.
Signing out
Open the user menu and choose Sign out. Close the browser on shared machines.